fix(gateway): increase WS handshake timeout from 3s to 10s by fuller-stack-dev · Pull Request #49262 · openclaw/openclaw

fuller-stack-dev · 2026-03-17T21:54:15Z

Summary

Fixes #46892 — the 3-second WS handshake timeout is too aggressive when the gateway event loop is busy, causing spurious gateway closed (1000) errors on CLI commands.

Changes

src/gateway/server-constants.ts:

Increase DEFAULT_HANDSHAKE_TIMEOUT_MS from 3_000 to 10_000
Add OPENCLAW_HANDSHAKE_TIMEOUT_MS env var for runtime override (removed VITEST gate)
Keep OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS as fallback so existing tests are unaffected

Why 10 seconds?

3s is too tight for loopback connections when the event loop is processing concurrent agent sessions, compaction, or long tool calls. 10s provides comfortable headroom while still catching genuinely broken connections. Users who need different values can set OPENCLAW_HANDSHAKE_TIMEOUT_MS.

Testing

Existing tests that use OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS continue to work (kept as fallback in the nullish coalescing chain)
New env var OPENCLAW_HANDSHAKE_TIMEOUT_MS validated with same Number.isFinite && > 0 guard

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5cac0f34c8

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

src/gateway/server-constants.ts

greptile-apps · 2026-03-17T21:56:33Z

Greptile Summary

This PR increases the WebSocket handshake timeout from 3 seconds to 10 seconds in src/gateway/server-constants.ts to address spurious gateway closed (1000) errors caused by a busy event loop during concurrent agent sessions, compaction, or long tool calls. It also introduces a new user-facing OPENCLAW_HANDSHAKE_TIMEOUT_MS environment variable for runtime override while correctly preserving the VITEST guard on the test-only OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS variable.

DEFAULT_HANDSHAKE_TIMEOUT_MS bumped from 3_000 → 10_000
New OPENCLAW_HANDSHAKE_TIMEOUT_MS env var added for all environments, validated with the same Number.isFinite && > 0 guard as the original test variable
OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS remains gated behind process.env.VITEST, so it cannot be read in production
|| (logical OR) is used instead of ??, so an empty-string value of OPENCLAW_HANDSHAKE_TIMEOUT_MS correctly falls through to the test-variable fallback rather than silently blocking it

Confidence Score: 5/5

This PR is safe to merge — it is a small, focused, well-reasoned timeout increase with no new logic paths that could cause regressions.
The change touches a single constant and a short env-var parsing helper. The VITEST guard on the test-only variable is preserved, the new user-facing override uses the same validation guard (Number.isFinite && > 0), and || (not ??) is used so an empty-string override correctly falls through to the test fallback. All previously raised concerns appear to have been addressed in this implementation.
No files require special attention.

_{Last reviewed commit: "fix: restore VITEST ..."}

src/gateway/server-constants.ts

fuller-stack-dev · 2026-03-17T22:13:25Z

Addressed both review findings in c4e0fa8:

VITEST guard restored — OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS is now gated behind process.env.VITEST again, so it can never leak into production. The new user-facing OPENCLAW_HANDSHAKE_TIMEOUT_MS remains available in all environments.
?? → || — Switched from nullish coalescing to logical OR so an empty-string OPENCLAW_HANDSHAKE_TIMEOUT_MS="" (common in .env placeholders) correctly falls through to the test var.
Formatting fixed — oxfmt now passes on server-constants.ts.

The other CI failures (secrets, contracts, test shards) are pre-existing/unrelated:

check — was solely the oxfmt formatting issue (now fixed)
contracts — pre-existing TS errors in @tloncorp package (channelContentConfig.ts)
test shards 1/2 — Node.js internal module status bug (flaky, not related to this change)

fuller-stack-dev · 2026-03-18T18:00:42Z

Greptile Summary

This PR increases the WebSocket handshake timeout from 3 s to 10 s and adds a OPENCLAW_HANDSHAKE_TIMEOUT_MS env var for runtime overrides, both reasonable changes for a busy event loop. The core concern is that removing the process.env.VITEST guard from the existing OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS variable silently expands its scope from test-only to all environments; if that variable leaks into production with a low value (tests use 20–200 ms), the gateway would reject every WS connection. There is also a minor edge case where using ?? instead of || for the env-var chain means an empty-string OPENCLAW_HANDSHAKE_TIMEOUT_MS prevents the test fallback from being read.

Key changes:

DEFAULT_HANDSHAKE_TIMEOUT_MS raised from 3_000 to 10_000

New OPENCLAW_HANDSHAKE_TIMEOUT_MS env var added as a user-facing override

OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS kept as a fallback but the process.env.VITEST guard protecting it was removed, making it effective in non-test environments

?? (nullish coalescing) used for the env-var chain instead of ||, which silently ignores the test fallback when the user-facing variable is set to an empty string

Confidence Score: 3/5

Safe to merge after restoring the VITEST guard on the test-only env var; the timeout increase itself is low-risk.

The timeout bump from 3 s to 10 s is benign and well-justified. The new user-facing env var follows the same validation pattern as the existing one. The P1 issue — removing the VITEST guard from OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS — is a real regression: any production environment where that variable is accidentally present would have its WS handshake timeout set to 20 ms, effectively breaking all connections. This needs to be fixed before the PR is merged, hence a score of 3 rather than 4–5.

src/gateway/server-constants.ts — specifically the removal of the VITEST guard on the test-only timeout variable.

Prompt To Fix All With AI
This is a comment left during a code review.
Path: src/gateway/server-constants.ts
Line: 27-28

Comment:
**Test-only env var guard removed — now effective in production**

The original code gated `OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS` behind `process.env.VITEST`, ensuring it was never read outside a Vitest run. That guard is now removed.

If this variable leaks into a production or staging environment (leftover from debugging, a misconfigured deploy script, or accidental env injection), `getHandshakeTimeoutMs()` will return whatever is stored there. Tests set this to `20` or `200` ms — either value would cause every WS connection to time out nearly instantly and break the gateway.

Consider restoring the `process.env.VITEST` restriction for the test-only variable. The new `OPENCLAW_HANDSHAKE_TIMEOUT_MS` can remain the unconstrained user-facing override, while the test shortcut is scoped back to Vitest runs only.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: src/gateway/server-constants.ts
Line: 27-28

Comment:
**Nullish coalescing blocks test fallback for empty-string override**

`??` only falls through on `null`/`undefined`. If `OPENCLAW_HANDSHAKE_TIMEOUT_MS` is set to an empty string `""` (common in `.env` placeholder files or CI variable groups), `envKey` resolves to `""`. The subsequent `if (envKey)` is then falsy, so the test-specific variable is never consulted even when it is explicitly set, and the function silently returns the default.

Using `||` (logical OR) instead would correctly fall through on empty strings and match the original intent of the fallback chain.

How can I resolve this? If you propose a fix, please make it concise.
Last reviewed commit: 5cac0f3

@greptileai review again if you would please

The 3-second default is too aggressive when the event loop is under load (concurrent sessions, compaction, agent turns), causing spurious 'gateway closed (1000)' errors on CLI commands like `openclaw cron list`. Changes: - Increase DEFAULT_HANDSHAKE_TIMEOUT_MS from 3_000 to 10_000 - Add OPENCLAW_HANDSHAKE_TIMEOUT_MS env var for user override (no VITEST gate) - Keep OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS as fallback for existing tests Fixes openclaw#46892

…llback, fix formatting

@fuller-stack-dev

…hanks @fuller-stack-dev)

obviyus · 2026-03-19T17:17:08Z

Landed on main.

Landed source commit: 0442be4
Merge commit: 36f394c

Thanks @fuller-stack-dev.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0442be4e5c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-19T17:19:19Z

src/gateway/server-constants.ts

+    process.env.OPENCLAW_HANDSHAKE_TIMEOUT_MS ||
+    (process.env.VITEST && process.env.OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS);


Keep the test-only handshake override effective under Vitest

Because getHandshakeTimeoutMs() now prefers OPENCLAW_HANDSHAKE_TIMEOUT_MS even when process.env.VITEST is set, the handshake-timeout tests are no longer hermetic against a developer's shell environment. src/gateway/server.preauth-hardening.test.ts:15-37 and src/gateway/server.auth.default-token.suite.ts:80-85 set OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS to 200/20ms and expect the socket to close within under a second, but a valid exported OPENCLAW_HANDSHAKE_TIMEOUT_MS (for example 60000 while tuning a local gateway) now overrides that and makes those tests stall or fail. The test-only variable should still win under Vitest, or these suites need to clear the runtime override first.

Useful? React with 👍 / 👎.

@fuller-stack-dev

…49262) * fix(gateway): increase WS handshake timeout from 3s to 10s The 3-second default is too aggressive when the event loop is under load (concurrent sessions, compaction, agent turns), causing spurious 'gateway closed (1000)' errors on CLI commands like `openclaw cron list`. Changes: - Increase DEFAULT_HANDSHAKE_TIMEOUT_MS from 3_000 to 10_000 - Add OPENCLAW_HANDSHAKE_TIMEOUT_MS env var for user override (no VITEST gate) - Keep OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS as fallback for existing tests Fixes openclaw#46892 * fix: restore VITEST guard on test env var, use || for empty-string fallback, fix formatting * fix: cover gateway handshake timeout env override (openclaw#49262) (thanks @fuller-stack-dev) --------- Co-authored-by: Wilfred <[email protected]> Co-authored-by: Ayaan Zaidi <[email protected]>

@fuller-stack-dev

…49262) * fix(gateway): increase WS handshake timeout from 3s to 10s The 3-second default is too aggressive when the event loop is under load (concurrent sessions, compaction, agent turns), causing spurious 'gateway closed (1000)' errors on CLI commands like `openclaw cron list`. Changes: - Increase DEFAULT_HANDSHAKE_TIMEOUT_MS from 3_000 to 10_000 - Add OPENCLAW_HANDSHAKE_TIMEOUT_MS env var for user override (no VITEST gate) - Keep OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS as fallback for existing tests Fixes openclaw#46892 * fix: restore VITEST guard on test env var, use || for empty-string fallback, fix formatting * fix: cover gateway handshake timeout env override (openclaw#49262) (thanks @fuller-stack-dev) --------- Co-authored-by: Wilfred <[email protected]> Co-authored-by: Ayaan Zaidi <[email protected]>

@fuller-stack-dev

…49262) * fix(gateway): increase WS handshake timeout from 3s to 10s The 3-second default is too aggressive when the event loop is under load (concurrent sessions, compaction, agent turns), causing spurious 'gateway closed (1000)' errors on CLI commands like `openclaw cron list`. Changes: - Increase DEFAULT_HANDSHAKE_TIMEOUT_MS from 3_000 to 10_000 - Add OPENCLAW_HANDSHAKE_TIMEOUT_MS env var for user override (no VITEST gate) - Keep OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS as fallback for existing tests Fixes openclaw#46892 * fix: restore VITEST guard on test env var, use || for empty-string fallback, fix formatting * fix: cover gateway handshake timeout env override (openclaw#49262) (thanks @fuller-stack-dev) --------- Co-authored-by: Wilfred <[email protected]> Co-authored-by: Ayaan Zaidi <[email protected]>

@fuller-stack-dev

…49262) * fix(gateway): increase WS handshake timeout from 3s to 10s The 3-second default is too aggressive when the event loop is under load (concurrent sessions, compaction, agent turns), causing spurious 'gateway closed (1000)' errors on CLI commands like `openclaw cron list`. Changes: - Increase DEFAULT_HANDSHAKE_TIMEOUT_MS from 3_000 to 10_000 - Add OPENCLAW_HANDSHAKE_TIMEOUT_MS env var for user override (no VITEST gate) - Keep OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS as fallback for existing tests Fixes openclaw#46892 * fix: restore VITEST guard on test env var, use || for empty-string fallback, fix formatting * fix: cover gateway handshake timeout env override (openclaw#49262) (thanks @fuller-stack-dev) --------- Co-authored-by: Wilfred <[email protected]> Co-authored-by: Ayaan Zaidi <[email protected]>

@fuller-stack-dev

…49262) * fix(gateway): increase WS handshake timeout from 3s to 10s The 3-second default is too aggressive when the event loop is under load (concurrent sessions, compaction, agent turns), causing spurious 'gateway closed (1000)' errors on CLI commands like `openclaw cron list`. Changes: - Increase DEFAULT_HANDSHAKE_TIMEOUT_MS from 3_000 to 10_000 - Add OPENCLAW_HANDSHAKE_TIMEOUT_MS env var for user override (no VITEST gate) - Keep OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS as fallback for existing tests Fixes openclaw#46892 * fix: restore VITEST guard on test env var, use || for empty-string fallback, fix formatting * fix: cover gateway handshake timeout env override (openclaw#49262) (thanks @fuller-stack-dev) --------- Co-authored-by: Wilfred <[email protected]> Co-authored-by: Ayaan Zaidi <[email protected]>

@fuller-stack-dev

…49262) * fix(gateway): increase WS handshake timeout from 3s to 10s The 3-second default is too aggressive when the event loop is under load (concurrent sessions, compaction, agent turns), causing spurious 'gateway closed (1000)' errors on CLI commands like `openclaw cron list`. Changes: - Increase DEFAULT_HANDSHAKE_TIMEOUT_MS from 3_000 to 10_000 - Add OPENCLAW_HANDSHAKE_TIMEOUT_MS env var for user override (no VITEST gate) - Keep OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS as fallback for existing tests Fixes openclaw#46892 * fix: restore VITEST guard on test env var, use || for empty-string fallback, fix formatting * fix: cover gateway handshake timeout env override (openclaw#49262) (thanks @fuller-stack-dev) --------- Co-authored-by: Wilfred <[email protected]> Co-authored-by: Ayaan Zaidi <[email protected]>

@fuller-stack-dev

…49262) * fix(gateway): increase WS handshake timeout from 3s to 10s The 3-second default is too aggressive when the event loop is under load (concurrent sessions, compaction, agent turns), causing spurious 'gateway closed (1000)' errors on CLI commands like `openclaw cron list`. Changes: - Increase DEFAULT_HANDSHAKE_TIMEOUT_MS from 3_000 to 10_000 - Add OPENCLAW_HANDSHAKE_TIMEOUT_MS env var for user override (no VITEST gate) - Keep OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS as fallback for existing tests Fixes openclaw#46892 * fix: restore VITEST guard on test env var, use || for empty-string fallback, fix formatting * fix: cover gateway handshake timeout env override (openclaw#49262) (thanks @fuller-stack-dev) --------- Co-authored-by: Wilfred <[email protected]> Co-authored-by: Ayaan Zaidi <[email protected]> (cherry picked from commit 36f394c)

@fuller-stack-dev

* fix(gateway): skip device pairing when auth.mode=none Fixes openclaw#42931 When gateway.auth.mode is set to "none", authentication succeeds with method "none" but sharedAuthOk remains false because the auth-context only recognises token/password/trusted-proxy methods. This causes all pairing-skip conditions to fail, so Control UI browser connections get closed with code 1008 "pairing required" despite auth being disabled. Short-circuit the skipPairing check: if the operator explicitly disabled authentication, device pairing (which is itself an auth mechanism) must also be bypassed. Fixes openclaw#42931 (cherry picked from commit 9bffa34) * fix(gateway): strip unbound scopes for shared-auth connects (cherry picked from commit 7dc447f) * fix(gateway): increase WS handshake timeout from 3s to 10s (openclaw#49262) * fix(gateway): increase WS handshake timeout from 3s to 10s The 3-second default is too aggressive when the event loop is under load (concurrent sessions, compaction, agent turns), causing spurious 'gateway closed (1000)' errors on CLI commands like `openclaw cron list`. Changes: - Increase DEFAULT_HANDSHAKE_TIMEOUT_MS from 3_000 to 10_000 - Add OPENCLAW_HANDSHAKE_TIMEOUT_MS env var for user override (no VITEST gate) - Keep OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS as fallback for existing tests Fixes openclaw#46892 * fix: restore VITEST guard on test env var, use || for empty-string fallback, fix formatting * fix: cover gateway handshake timeout env override (openclaw#49262) (thanks @fuller-stack-dev) --------- Co-authored-by: Wilfred <[email protected]> Co-authored-by: Ayaan Zaidi <[email protected]> (cherry picked from commit 36f394c) * fix(gateway): skip Control UI pairing when auth.mode=none (closes openclaw#42931) (openclaw#47148) When auth is completely disabled (mode=none), requiring device pairing for Control UI operator sessions adds friction without security value since any client can already connect without credentials. Add authMode parameter to shouldSkipControlUiPairing so the bypass fires only for Control UI + operator role + auth.mode=none. This avoids the openclaw#43478 regression where a top-level OR disabled pairing for ALL websocket clients. (cherry picked from commit 26e0a3e) * fix(gateway): clear trusted-proxy control ui scopes (cherry picked from commit ccf16cd) * fix(gateway): guard interface discovery failures Closes openclaw#44180. Refs openclaw#47590. Co-authored-by: Peter Steinberger <[email protected]> (cherry picked from commit 3faaf89) * fix(gateway): suppress ciao interface assertions Closes openclaw#38628. Refs openclaw#47159, openclaw#52431. Co-authored-by: Peter Steinberger <[email protected]> (cherry picked from commit c0d4abc) * fix(gateway): run before_tool_call for HTTP tools (cherry picked from commit 8cc0c9b) * fix(gateway): skip seq-gap broadcast for stale post-lifecycle events (openclaw#43751) * fix: stop stale gateway seq-gap errors (openclaw#43751) (thanks @caesargattuso) * fix: keep agent.request run ids session-scoped --------- Co-authored-by: Ayaan Zaidi <[email protected]> (cherry picked from commit 57f1cf6) * fix(gateway): honor trusted proxy hook auth rate limits (cherry picked from commit 4da617e) * fix(gateway): enforce browser origin check regardless of proxy headers In trusted-proxy mode, enforceOriginCheckForAnyClient was set to false whenever proxy headers were present. This allowed browser-originated WebSocket connections from untrusted origins to bypass origin validation entirely, as the check only ran for control-ui and webchat client types. An attacker serving a page from an untrusted origin could connect through a trusted reverse proxy, inherit proxy-injected identity, and obtain operator.admin access via the sharedAuthOk / roleCanSkipDeviceIdentity path without any origin restriction. Remove the hasProxyHeaders exemption so origin validation runs for all browser-originated connections regardless of how the request arrived. Fixes GHSA-5wcw-8jjv-m286 (cherry picked from commit ebed3bb) * fix(gateway): harden health monitor account gating (openclaw#46749) * gateway: harden health monitor account gating * gateway: tighten health monitor account-id guard (cherry picked from commit 29fec8b) * fix(gateway): bound unanswered client requests (openclaw#45689) * fix(gateway): bound unanswered client requests * fix(gateway): skip default timeout for expectFinal requests * fix(gateway): preserve gateway call timeouts * fix(gateway): localize request timeout policy * fix(gateway): clamp explicit request timeouts * fix(gateway): clamp default request timeout (cherry picked from commit 5fc43ff) * fix(gateway): propagate real gateway client into plugin subagent runtime Plugin subagent dispatch used a hardcoded synthetic client carrying operator.admin, operator.approvals, and operator.pairing for all runtime.subagent.* calls. Plugin HTTP routes with auth:"plugin" require no gateway auth by design, so an unauthenticated external request could drive admin-only gateway methods (sessions.delete, agent.run) through the subagent runtime. Propagate the real gateway client into the plugin runtime request scope when one is available. Plugin HTTP routes now run inside a scoped runtime client: auth:"plugin" routes receive a non-admin synthetic operator.write client; gateway-authenticated routes retain admin-capable scopes. The security boundary is enforced at the HTTP handler level. Fixes GHSA-xw77-45gv-p728 (cherry picked from commit a1520d7) * fix(gateway): enforce caller-scope subsetting in device.token.rotate device.token.rotate accepted attacker-controlled scopes and forwarded them to rotateDeviceToken without verifying the caller held those scopes. A pairing-scoped token could rotate up to operator.admin on any already-paired device whose approvedScopes included admin. Add a caller-scope subsetting check before rotateDeviceToken: the requested scopes must be a subset of client.connect.scopes via the existing roleScopesAllow helper. Reject with missing scope: <scope> if not. Also add server.device-token-rotate-authz.test.ts covering both the priv-esc path and the admin-to-node-invoke chain. Fixes GHSA-4jpw-hj22-2xmc (cherry picked from commit dafd61b) * fix(gateway): pin plugin webhook route registry (openclaw#47902) (cherry picked from commit a69f619) * fix(gateway): split conversation reset from admin reset (cherry picked from commit c91d162) * fix(gateway): harden token fallback/reconnect behavior and docs (openclaw#42507) * fix(gateway): harden token fallback and auth reconnect handling * docs(gateway): clarify auth retry and token-drift recovery * fix(gateway): tighten auth reconnect gating across clients * fix: harden gateway token retry (openclaw#42507) (thanks @joshavant) (cherry picked from commit a76e810) * fix: adapt cherry-picks for fork TS strictness - Replace OpenClawConfig with RemoteClawConfig in server-channels and server-runtime-state - Replace loadOpenClawPlugins with loadRemoteClawPlugins in server-plugins and remove unsupported runtimeOptions field and dead subagent runtime code - Export HookClientIpConfig type from server-http and thread it through server/hooks into server-runtime-state and server.impl - Create plugins-http/ submodules (path-context, route-match, route-auth) extracted from the monolithic plugins-http.ts by upstream refactor - Create stub modules for gutted upstream layers: acp/control-plane/manager, agents/bootstrap-cache, agents/pi-embedded, agents/internal-events - Strip thinkingLevel, reasoningLevel, skillsSnapshot from SessionEntry literals in agent.ts and session-reset-service.ts (Pi-specific fields) - Remove internalEvents from agent ingress opts and loadGatewayModelCatalog from sessions patch call (not present in fork types) - Fix connect-policy tests to pass booleans instead of role strings for the sharedAuthOk parameter (fork changed the function signature) - Add isHealthMonitorEnabled to ChannelManager mocks in test files - Widen runBeforeToolCallHook mock return type to accept blocked: true - Add explicit string types for msg params in server-plugins logger Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * fix: apply fork naming to cherry-picked bonjour files --------- Co-authored-by: Andrew Demczuk <[email protected]> Co-authored-by: Peter Steinberger <[email protected]> Co-authored-by: fuller-stack-dev <[email protected]> Co-authored-by: Wilfred <[email protected]> Co-authored-by: Ayaan Zaidi <[email protected]> Co-authored-by: caesargattuso <[email protected]> Co-authored-by: Robin Waslander <[email protected]> Co-authored-by: Tak Hoffman <[email protected]> Co-authored-by: Peter Steinberger <[email protected]> Co-authored-by: Josh Avant <[email protected]> Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

openclaw-barnacle bot added gateway Gateway runtime size: XS labels Mar 17, 2026

chatgpt-codex-connector bot reviewed Mar 17, 2026

View reviewed changes

src/gateway/server-constants.ts Outdated Show resolved Hide resolved

greptile-apps bot reviewed Mar 17, 2026

View reviewed changes

src/gateway/server-constants.ts Outdated Show resolved Hide resolved

src/gateway/server-constants.ts Outdated Show resolved Hide resolved

fuller-stack-dev mentioned this pull request Mar 18, 2026

bug: DEFAULT_HANDSHAKE_TIMEOUT_MS too aggressive (3s) — causes spurious disconnects #47931

Closed

Wilfred and others added 3 commits March 19, 2026 22:41

fix: restore VITEST guard on test env var, use || for empty-string fa…

1f60b9c

…llback, fix formatting

fix: cover gateway handshake timeout env override (openclaw#49262) (t…

0442be4

…hanks @fuller-stack-dev)

obviyus force-pushed the fix/ws-handshake-timeout-46892 branch from c4e0fa8 to 0442be4 Compare March 19, 2026 17:14

obviyus requested a review from a team as a code owner March 19, 2026 17:14

obviyus merged commit 36f394c into openclaw:main Mar 19, 2026
37 of 41 checks passed

obviyus self-assigned this Mar 19, 2026

chatgpt-codex-connector bot reviewed Mar 19, 2026

View reviewed changes

github-actions bot mentioned this pull request Mar 19, 2026

📡 Upstream Digest — 2026-03-19 18:44 UTC curtismercier/openclaw-mods#309

Open

This was referenced Mar 20, 2026

WebSocket handshake timeout (3000ms) causes CLI commands to fail intermittently #48954

Open

[Bug]: Gateway WS handshake timeout (3s) not configurable in production; closes openclaw acp bridge connections #50665

Open

kokoyroy mentioned this pull request Mar 20, 2026

WebSocket CLI connection fails after upgrade to 2026.3.13 — handshake timeout on loopback #47265

Open

fuller-stack-dev mentioned this pull request Mar 20, 2026

Gateway WS handshake timeout (3s) too aggressive — causes spurious 'gateway closed (1000)' on busy event loops #46892

Closed

henry-the-frog mentioned this pull request Mar 20, 2026

feat(gateway): make handshake timeout configurable via gateway.handshakeTimeoutMs #51282

Open

wangji0923 mentioned this pull request Mar 21, 2026

CLI → Gateway WebSocket connections timeout in v2026.3.12+ (Regression) #51438

Open

alexey-pelykh mentioned this pull request Mar 22, 2026

Cherry-pick: Gateway fixes and hardening (20 commits) remoteclaw/remoteclaw#1825

Closed

alexey-pelykh mentioned this pull request Mar 23, 2026

Cherry-pick: Gateway fixes and improvements (1/2) (50 commits) remoteclaw/remoteclaw#1869

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(gateway): increase WS handshake timeout from 3s to 10s#49262

fix(gateway): increase WS handshake timeout from 3s to 10s#49262
obviyus merged 3 commits intoopenclaw:mainfrom
fuller-stack-dev:fix/ws-handshake-timeout-46892

fuller-stack-dev commented Mar 17, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

Uh oh!

greptile-apps bot commented Mar 17, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

fuller-stack-dev commented Mar 17, 2026

Uh oh!

fuller-stack-dev commented Mar 18, 2026

Greptile Summary

Confidence Score: 3/5

Uh oh!

Uh oh!

obviyus commented Mar 19, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Mar 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		process.env.OPENCLAW_HANDSHAKE_TIMEOUT_MS \|\|
		(process.env.VITEST && process.env.OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS);

Uh oh!

Conversation

fuller-stack-dev commented Mar 17, 2026

Summary

Changes

Why 10 seconds?

Testing

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

greptile-apps bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Uh oh!

Uh oh!

Uh oh!

fuller-stack-dev commented Mar 17, 2026

Uh oh!

fuller-stack-dev commented Mar 18, 2026

Greptile Summary

Confidence Score: 3/5

Uh oh!

Uh oh!

obviyus commented Mar 19, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

greptile-apps bot commented Mar 17, 2026 •

edited

Loading